CVE-2022-22990: falha de alta gravidade em Western Digital My Cloud
Limited authentication bypass vulnerability on Western Digital My Cloud devices
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.8epss 2.2%
A limited authentication bypass vulnerability was discovered that could allow an attacker to achieve remote code execution and escalate privileges on the My Cloud devices. Addressed this vulnerability by changing access token validation logic and rewriting rule logic on PHP scripts.
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
Produtos afetados
Western Digital · My CloudCVEs relacionadas — Western Digital My Cloud
No mesmo produto, das mais perigosas para as menos.
CVE-2022-29844MEDIUMWestern Digital My Cloud OS 5 arbitrary file read and write vulnerability via ftpEPSS 36.4%CVE-2022-22995CRITICALWestern Digital My Cloud OS 5 and My Cloud Home Unauthenticated Arbitrary File Write Vulnerability in NetatalkEPSS 2.7%CVE-2022-22994HIGHInsufficient Verification of Data Authenticity Remote Code Execution Vulnerability on Western Digital My Cloud devices.EPSS 1.9%CVE-2022-22989CRITICALPre-authenticated stack overflow vulnerability on FTP ServiceEPSS 1.4%CVE-2022-22991HIGHCommand injection through unsecured HTTP calls on Western Digital My Cloud devicesEPSS 1.3%CVE-2022-29843MEDIUMWestern Digital My Cloud OS 5 devices Command Injection VulnerabilityEPSS 1.2%